4

Although GDPR has been in place for some time, my organisation has had a dispensation to essentially ignore it up until now. The dispensation was because the contract from the government we were on was an interim basis while a new provider got their system online. The thinking was we'd be turning off our system at any time and handing over. Fast-forward seven years and the new provider hasn't done what was asked of them, so we're staying put.

We've now been told by the ministry to bring ourselves into GDPR compliance and one of the issues being raised is about backups. My understanding is that for day-to-day business, simply deleting the backup file when it ages out is enough to be compliant. More thorough cleansing is possibly needed when disposing of hardware, but no extra measures are required for business-as-usual backup maintenance.

However, there's some questions being asked about whether we need to completely erase any deleted files from the disk. This complete erasure apparently uses third-party software to totally remove the file and render it unrecoverable.

Is it now the norm to completely erase backups due to GDPR?

If that's what people have always done and we've never been doing it right, I'll take that too.

9
  • 6
    Questions about GDPR are more suitable to discuss with a legal professional. Don't take an answer from some random internet person, when there might be serious consequences on your career and/or company.
    – vonPryz
    Jan 12 at 10:41
  • 1
    I appreciate that the specifics should come from a qualified professional but I'm interested in what advice most people have received. I'm not going to base our approach on any answer I get here, at the end of the day, the government will tell us what we're doing and we won't have much of a say in it. I do want to get an idea of what the wider community is doing. Do most companies interpret GDPR as compelling the complete. irretrievable removal of a old backup or does the normal deletion process cover it?
    – BWFC
    Jan 12 at 11:19
  • 1
    @mustaccio, I'm interested how the requirements have been interpreted by the wider community. I want to clarify my understanding, which is that it's not necessary to delete to the point that it's unrecoverable. I'm in a position where I can probably inform what decision is made but not actually make it. If I'm totally on the wrong track then I'd like to know that.
    – BWFC
    Jan 12 at 12:58
  • 2
    I am well aware of the fines for non-compliance and the need for specific interpretation. I'm also increasingly aware that I'm not expressing the point of my question particularly clearly. That point is, in the two years since GDPR was implemented and the five since it was announced, across many database forums, blogs and events, this is the first I've heard that 'nuking from orbit' is necessary to be compliant. Is this the understanding of the wider database community? Do all DBA's who handle data affected by GDPR have to delete backups that thoroughly to remain compliant?
    – BWFC
    Jan 12 at 13:21
  • 2
    GDPR does not directly define "erasure". But I'd be inclined to apply the same standard as for anonymization: that there are no reasonably likely means to recover the personal data. Your security measures should consider the state of the art. Thus, I would assume that backups should be encrypted, and that they can be deleted by shredding the key. Overwriting a tape should also work. I'm wary of hardware based solutions like shredder programs since they're difficult to verify and might be snake oil. Aspects of this question might be interesting on the Law and Information Security sites.
    – amon
    Jan 12 at 21:35
7

From my position as not-at-all-a-legal-expert, we consider making a backup unrecoverable to be due diligence even though not explicitly stated anywhere. If regulations say it needs to go, then it needs to be fully gone. Many suggest that just deleting backups is sufficient, but we take a more careful interpretation partly because we'd prefer to anyway and partly because some clients would insist anyway. We work with significantly regulated companies, and store PPI of our clients' users and our clients' customers.

For local storage this is done with:

  1. Encryption at rest: all our drives use FDE (via BitLocker with Windows). This covers any active data too.
  2. While the above should be sufficient for most threats (someone taking the drive shouldn't be able to unlock it), I suggest shredding files instead of just deleting them. This doesn't protect you from much more than FDE (if someone gets access to the drive while mounted via an RCE flaw they'll still get the not-yet-deleted backups) it is easy to do so do it as due diligence.
  3. As you state, properly disposing of drives when they are no longer in use: secure wipe then physical destruction.
  4. Consider configuring TDE for your databases too.

For cloud storage we have less control, the data may be moved all over the place while it is active and even if you knew what drives it had existed on you don't have the level of control needed to properly ensure they are securely wiped, and almost all of our DBs with sensitive data are out in Azure. Here you need to:

  1. Make sure all the relevant options for storage protection are turned on. TDE in the DBs, FDE on storage accounts and VM drives, ... These are usually by default anyway these days, but make sure and consider if you feel the need to use “bring your own key” variants and so forth.
  2. Make sure backup retention levels are correctly set for the expiry promises you have given to your client(s).

Backups are a bit of a grey area by our reading of the GDPR, and we would take a very similar stance with our data anyway even if it didn't exist, so you may need to get someone with legislative expertise to assess your stance with respect to what data you hold and about whom and for who.

A key question to ask yourself when thinking about these matters is: if you were your client, or you were a third party auditor assessing you on behalf of such a client, or your personal data was in those systems, would you be satisfied that what is done with the data represents due diligence & best practise?

3

Absolutely not a lawyer and this is not in any way legal advice. Talk to a pro.

That said...

The technical approach I've been told is acceptable comes from the United States legal system. There is a legal process (see above, not a lawyer) where a case is dismissed in such a way that not only was the person innocent, but from a legal standpoint, they were never charged. Are they required to go through all the old backups and delete everything, or render the backups unusable?

No.

Instead, they're required to use artificial keys to mark their cases. Then, when something has to be purged, even from backups, they keep the key around and run a delete process as part of the restore, based on that key. The key cannot contain personally identifying information, or it defeats the purpose. It requires quite a bit of planning & discipline, but that's my understanding of how these things are managed.

I've spoken with legal people (and again, this doesn't constitute that for you), and they said this approach should work. However, they sure as heck do hedge their bets when it comes to language. I couldn't get a guarantee from anyone that this is completely, perfectly, adequate.

Of course, on top of that, encryption, privacy, security, all that stuff has to be in place.

-1

Simplifying what was already present at David Spillett answer

However, there's some questions being asked about whether we need to completely erase any deleted files from the disk.

Once you delete the backup from a disk, you cannot count with recovering it. In fact, given that any DB will be running on SSD disks, it is probably completely irrecoverable as soon as it gets deleted.

So, you are deleting some backups, and will be unable to restore the db from it. However, it might be possible that in some disk sector a block remains readable, containing Personal Identifiable data (e.g. an INSERT row). Since it is so cheap to perform a secure deletion, it is better to always do that instead of a "normal" one. This way you do not need to worry about this possibility (plus, it's an easy point to add in the "List of measures you take to protect the data").

This complete erasure apparently uses third-party software to totally remove the file and render it unrecoverable.

I suspect the actual point behind the question is if you should buy some expensive "third-party software" to "really erase everything forever". However you don't need a special advanced software claiming to use some specially-designed patterns on N passes.

Every *nix system have a standard utility named shred which does this. And while I don't think Windows has that built-in, there are plenty of programs that can do that. From shred.exe versions of the Linux programs, to specific GUI programs, such as Eraser or File Shredder.

Also of note, you don't really need multiple passes for secure deletion nowadays (if it was ever needed).

PS: I hope you also keep some (encrypted) off-site backups as well.

New contributor
Ángel is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
1
  • You are free to downvote if you think this isn't useful, but could you explain what you find wrong/bad with the answer?
    – Ángel
    yesterday

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.